@octane-xplat/auth 0.10.0 → 0.11.0

package/dist/web/platform/src/host-runtime.web.js

@@ -0,0 +1,76 @@
+import { createWebKitTransport } from "./host-bridge.web.js";
+import { createHostClient } from "./host-protocol.js";
+//#region ../platform/src/host-runtime.web.ts
+var client;
+var capabilityTable;
+/** Return the native service client when this page is inside a desktop webview. */
+function desktopHostClient() {
+	if (client !== void 0) return client;
+	const transport = createWebKitTransport();
+	client = transport ? createHostClient(transport) : null;
+	return client;
+}
+/** Read values installed before the document's application scripts execute. */
+function desktopHostBootstrap() {
+	if (typeof window === "undefined") return null;
+	return window.__xplatHostSnapshot ?? null;
+}
+function desktopHostSupports(service, method) {
+	const host = desktopHostClient();
+	if (!host) return Promise.resolve(false);
+	capabilityTable ??= host.capabilities().catch(() => ({}));
+	return capabilityTable.then((capabilities) => capabilities[service]?.includes(method) ?? false);
+}
+/** Typed desktop service facade; null outside a supported native webview. */
+function desktopHost() {
+	const host = desktopHostClient();
+	if (!host) return null;
+	return {
+		app: {
+			getInfo: () => host.call("app", "getInfo"),
+			getState: () => host.call("app", "getState"),
+			getWindowSize: () => host.call("app", "getWindowSize"),
+			consumeInitialUrl: () => host.call("app", "consumeInitialUrl")
+		},
+		clipboard: {
+			read: () => host.call("clipboard", "read"),
+			write: (value) => host.call("clipboard", "write", value)
+		},
+		files: {
+			pick: (accept, options) => host.call("files", "pick", accept, options),
+			readText: (uri) => host.call("files", "readText", uri),
+			writeText: (name, text) => host.call("files", "writeText", name, text)
+		},
+		notifications: {
+			ensure: () => host.call("notifications", "ensure"),
+			notify: (title, body) => host.call("notifications", "notify", title, body)
+		},
+		secureStorage: {
+			get: (key) => host.call("secureStorage", "get", key),
+			set: (key, value) => host.call("secureStorage", "set", key, value),
+			remove: (key) => host.call("secureStorage", "remove", key)
+		},
+		appearance: { get: () => host.call("appearance", "get") },
+		windows: {
+			open: (options) => host.call("windows", "open", options),
+			close: (id) => host.call("windows", "close", id),
+			setTitle: (id, title) => host.call("windows", "setTitle", id, title)
+		},
+		system: {
+			openUrl: (url) => host.call("system", "openUrl", url),
+			openPath: (path) => host.call("system", "openPath", path),
+			shareContent: (input) => host.call("system", "shareContent", input)
+		},
+		storage: {
+			get: (key) => host.call("storage", "get", key),
+			set: (key, value) => host.call("storage", "set", key, value),
+			remove: (key) => host.call("storage", "remove", key)
+		},
+		capabilities: () => host.capabilities(),
+		supports: desktopHostSupports,
+		on: (name, listener) => host.on(name, listener),
+		dispose: () => host.dispose()
+	};
+}
+//#endregion
+export { desktopHost, desktopHostBootstrap, desktopHostClient, desktopHostSupports };

package/dist/web/platform/src/index.web.js

@@ -0,0 +1,13 @@
+import "./device.web.js";
+import "./app-info.web.js";
+import "./clipboard.web.js";
+import "./locale.web.js";
+import "./webauthn.web.js";
+import { random } from "./random.web.js";
+import { authSession } from "./auth-session.web.js";
+import "./deep-links.web.js";
+import "./lifecycle.web.tsrx.js";
+import "./safe-area.web.tsrx.js";
+import "./screen.web.tsrx.js";
+import "./breakpoints.web.tsrx.js";
+export { authSession, random };

package/dist/web/platform/src/lifecycle.web.tsrx.js

@@ -0,0 +1,3 @@
+import { hookSlots } from "octane";
+/* @__PURE__ */ hookSlots(2) + 1;
+//#endregion

package/dist/web/platform/src/locale.web.js

@@ -0,0 +1,10 @@
+(() => {
+	const tag = navigator.language ?? "";
+	const [language = "", region = ""] = tag.split("-");
+	return {
+		tag,
+		language,
+		region
+	};
+})();
+//#endregion

package/dist/web/platform/src/random.web.js

@@ -0,0 +1,21 @@
+//#region ../platform/src/random.web.ts
+var source = () => typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function" ? crypto : null;
+var random = {
+	get supported() {
+		return source() !== null;
+	},
+	fill(view) {
+		if (!ArrayBuffer.isView(view)) throw new TypeError("random.fill: expected an ArrayBufferView");
+		const crypto = source();
+		if (!crypto) throw new Error("random: crypto.getRandomValues is unavailable");
+		const target = new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
+		for (let offset = 0; offset < target.length; offset += 65536) crypto.getRandomValues(target.subarray(offset, offset + 65536));
+		return view;
+	},
+	bytes(length) {
+		if (!Number.isInteger(length) || length < 0) throw new RangeError("random.bytes: length must be a non-negative integer");
+		return random.fill(new Uint8Array(length));
+	}
+};
+//#endregion
+export { random };

package/dist/web/platform/src/safe-area.web.tsrx.js

@@ -0,0 +1,3 @@
+import { hookSlots } from "octane";
+/* @__PURE__ */ hookSlots(2) + 1;
+//#endregion

package/dist/web/platform/src/screen.web.tsrx.js

@@ -0,0 +1,3 @@
+import { hookSlots } from "octane";
+/* @__PURE__ */ hookSlots(2) + 1;
+//#endregion

package/dist/web/platform/src/webauthn.web.js

@@ -0,0 +1,2 @@
+typeof window !== "undefined" && window.isSecureContext && typeof PublicKeyCredential === "function" && navigator.credentials;
+//#endregion

package/dist/web/secure-storage/src/secure-storage.web.js

@@ -0,0 +1,21 @@
+import { desktopHost } from "../../platform/src/host-runtime.web.js";
+//#region ../secure-storage/src/secure-storage.web.ts
+var hostStore = {
+	get: (key) => desktopHost()?.secureStorage.get(key) ?? Promise.resolve(null),
+	set: (key, value) => desktopHost()?.secureStorage.set(key, value) ?? Promise.resolve(false),
+	remove: (key) => desktopHost()?.secureStorage.remove(key) ?? Promise.resolve(false)
+};
+var secureStorage = {
+	get supported() {
+		return desktopHost() !== null;
+	},
+	async ensure() {
+		const host = desktopHost();
+		return host && await host.supports("secureStorage", "get") ? "granted" : "unsupported";
+	},
+	get impl() {
+		return desktopHost() ? hostStore : null;
+	}
+};
+//#endregion
+export { secureStorage };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@octane-xplat/auth",
-  "version": "0.10.0",
-  "description": "Sign in with Apple + Google Sign-In for Octane xplat — native SDKs on iOS/Android, platform web SDKs in the browser",
+  "version": "0.11.0",
+  "description": "Sign in with Apple + Google Sign-In + hosted-auth sessions for Octane xplat — native SDKs on iOS/Android, platform web SDKs in the browser",
   "keywords": [
     "android",
     "apple",
@@ -12,6 +12,7 @@
     "nativescript",
     "oauth",
     "octane",
+    "pkce",
     "sign-in",
     "web",
     "xplat"
@@ -53,12 +54,13 @@
   "dependencies": {
     "@nativescript/apple-sign-in": "2.0.0",
     "@nativescript/google-signin": "2.1.1",
-    "@octane-xplat/platform": "0.10.0"
+    "@octane-xplat/platform": "0.11.0",
+    "@octane-xplat/secure-storage": "0.11.0"
   },
   "devDependencies": {
     "@nativescript-community/octane": "0.2.4",
     "@nativescript/core": "9.1.2",
-    "@octane-xplat/macos-renderer": "0.10.0",
+    "@octane-xplat/macos-renderer": "0.11.0",
     "@octanejs/vite-plugin": "0.1.61",
     "@tsrx/typescript-plugin": "0.4.11",
     "octane": "0.6.3",

package/src/apple.macos.ts

@@ -3,6 +3,7 @@
 // available since macOS 10.15). The `com.apple.developer.applesignin`
 // entitlement must sit on the packaged app for the sheet to present;
 // hosts without it still load the framework and surface the OS error.
+import { sha256Hex } from './sha256'
 import type {
 	AppleAuth,
 	AppleAuthConfig,
@@ -46,87 +47,6 @@ function isCancel(error: unknown): boolean {
 	)
 }
 
-function utf8Bytes(input: string): Uint8Array {
-	const data = NSString.stringWithString(input).dataUsingEncoding(4 /* NSUTF8StringEncoding */)
-	return new Uint8Array(interop.bufferFromData(data))
-}
-
-// FIPS 180-4 — the request nonce must be the hex SHA-256 of the app's nonce
-// (same transform the iOS plugin applies via CommonCrypto, which has no
-// node-api metadata). Kept local to stay dependency-free.
-function sha256Hex(input: string): string {
-	const K = new Uint32Array([
-		0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-		0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-		0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-		0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-		0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-		0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-		0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-		0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
-	])
-
-	const H = new Uint32Array([
-		0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
-	])
-
-	const bytes = utf8Bytes(input)
-	const bitLen = bytes.length * 8
-	const padded = new Uint8Array((bytes.length + 9 + 63) & ~63)
-	padded.set(bytes)
-	padded[bytes.length] = 0x80
-	const dv = new DataView(padded.buffer)
-	dv.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000))
-	dv.setUint32(padded.length - 4, bitLen >>> 0)
-	const w = new Uint32Array(64)
-	for (let block = 0; block < padded.length; block += 64) {
-		for (let t = 0; t < 16; t++) {
-			w[t] = dv.getUint32(block + t * 4)
-		}
-
-		for (let t = 16; t < 64; t++) {
-			const s0 =
-				((w[t - 15] >>> 7) | (w[t - 15] << 25)) ^
-				((w[t - 15] >>> 18) | (w[t - 15] << 14)) ^
-				(w[t - 15] >>> 3)
-
-			const s1 =
-				((w[t - 2] >>> 17) | (w[t - 2] << 15)) ^
-				((w[t - 2] >>> 19) | (w[t - 2] << 13)) ^
-				(w[t - 2] >>> 10)
-
-			w[t] = (w[t - 16] + s0 + w[t - 7] + s1) >>> 0
-		}
-
-		let [a, b, c, d, e, f, g, h] = H
-		for (let t = 0; t < 64; t++) {
-			const S1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7))
-			const t1 = (h + S1 + ((e & f) ^ (~e & g)) + K[t] + w[t]) >>> 0
-			const S0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10))
-			const t2 = (S0 + ((a & b) ^ (a & c) ^ (b & c))) >>> 0
-			h = g
-			g = f
-			f = e
-			e = (d + t1) >>> 0
-			d = c
-			c = b
-			b = a
-			a = (t1 + t2) >>> 0
-		}
-
-		H[0] = (H[0] + a) >>> 0
-		H[1] = (H[1] + b) >>> 0
-		H[2] = (H[2] + c) >>> 0
-		H[3] = (H[3] + d) >>> 0
-		H[4] = (H[4] + e) >>> 0
-		H[5] = (H[5] + f) >>> 0
-		H[6] = (H[6] + g) >>> 0
-		H[7] = (H[7] + h) >>> 0
-	}
-
-	return [...H].map((x) => x.toString(16).padStart(8, '0')).join('')
-}
-
 function toCredential(credential: any): AuthCredential {
 	const tokenData = credential.valueForKey('identityToken')
 	const codeData = credential.valueForKey('authorizationCode')

package/src/base64.ts

@@ -0,0 +1,25 @@
+// Unpadded base64url (RFC 4648 §5) — the encoding PKCE and hosted-auth
+// wire formats use. `btoa` is not declared on every target's typecheck,
+// so encode by hand.
+
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_'
+
+export function bytesToBase64Url(bytes: Uint8Array): string {
+	let out = ''
+	for (let i = 0; i < bytes.length; i += 3) {
+		const a = bytes[i]
+		const b = i + 1 < bytes.length ? bytes[i + 1] : 0
+		const c = i + 2 < bytes.length ? bytes[i + 2] : 0
+		out += ALPHABET[a >> 2]
+		out += ALPHABET[((a & 0x03) << 4) | (b >> 4)]
+		if (i + 1 < bytes.length) {
+			out += ALPHABET[((b & 0x0f) << 2) | (c >> 6)]
+		}
+
+		if (i + 2 < bytes.length) {
+			out += ALPHABET[c & 0x3f]
+		}
+	}
+
+	return out
+}